Qualys CTO Dilip Bachwani Makes the Case for a Risk Operations Center

Hey folks, we're back at Rock on Americas here in Austin, and I'm chatting with my good friend, Dylan. How are you doing, buddy? Good to meet you.

Good to see you. And we're talking about cybersecurity and risks. And arguably, cybersecurity has always been a game of risk, but the nature of those risks are, is changing.

We have AI and coming down the road, quantum. What's your assessment of what's going on here? Good questions.

I think today, as an industry, we are used to doing certain things in the context of how are we looking at risk, how are we prioritizing risk, how are we looking at addressing that risk? I think what is happening now, and it is happening in some cases a little bit rapidly, is some of these threat vectors are changing. AI agents and agents acting in a more autonomous manner.

The AI agents have been out for a while. We've been working with agents. Initially, it started with asking a question and getting an answer.

What is happening now is these agents are taking actions. They have responsibilities. They are getting connected to our other enterprise systems.

But how we have thought of security in the context of human users and machine identity, what we would earlier call non-human identities, AI agents haven't really been given that rigor yet on what access do they have. So that's an area that we really have to think about. There are other things that are coming.

Quantum, as an example. It's not potentially perceived as urgent as securing your AI footprint. But it is something that we have to act on now because the data that's available now, even though it's encrypted, could be decrypted three years, five years from now.

True that. Right? So, then we have to think about how are we protecting that data.

We have to think about how are we moving to more quantum-resistant cryptography algorithms. We have to think about all of that. The software supply chain is changing.

Vulnerabilities are growing. What we are finding, as an example, the Patch Tuesday that just came out yesterday, the largest number of findings. And out of that, a good data point, a customer of ours, they had about 400 million findings the day before.

After Patch Tuesday, they are at over a billion findings. Crazy. Right.

And all of this is being driven by AI. I know Patch Tuesday is more Microsoft, but similarly, open source packages have a lot of vulnerabilities. There's a lot of risk coming out.

And I think we have to think about all these things together now. Security is evolving, for sure. To your point, not all these AI agents are of equal risk, right?

And they have different functions. And I think security people need to maybe dive in a little bit deeper to understand what level of security to apply based on the risk of each one of those, and they're different. So how does that kind of change the nature of the job, do you think?

That's a good point, too. Because agents are being rolled out everywhere, right? By some measure, almost 40% of all organizations will have agents deployed in some significant capacity by the end of this year or early into the next year.

And that's a very rapid change because AI agents proliferated only after the MCP protocol came out, and that's under two years right now. Mm. I think the way we have to look at it is if...

And this comes back to how we more traditionally look at risk. If everything is critical, nothing is critical, right? And that's true for AI agents, too.

We have to get a sense of, as we are building these agents, what systems are these agents talking to? Are they connecting to Crown Jewels? Are they connecting to a support platform that's giving you better information on how to use the product?

Those are two different use cases. And we will have to narrow down and say, "What are our critical systems, data that we want to protect? " Firstly, inventory that.

That visibility is missing quite a bit. Because you can have large language models acting as orchestrators and tools behind those models that are connecting to systems all over the place. And many times, security teams don't have that visibility.

Mm-hmm. But now capabilities are coming out. As an example, even with Total AI, our cybersecurity solution for AI, we are providing complete visibility into what is your AI footprint across Shadow AI, what NCP servers do you have, what tools are those servers using?

And then you have to get that inventory and get a sense of what is everything that I have? What are the most important things that I should focus on first? And then think of identity and think of these agents as digital employees that have roles and responsibilities, but how do you set up guardrails along those roles and responsibilities?

Yeah. And it seems like all this is now happening at machine speed. For sure.

And is that changing the nature of the game? Because when I talk to folks, exploits are becoming available long before the patch shows up. And then I have to figure out what controls I can put in place while I wait for the patch, and then hopefully I'm automatically deploying the patch, assuming the patch doesn't break everything.

So it seems like the game has fundamentally changed. Oh, there is no question about it. I think the pace at which vulnerabilities are coming out and the pace at which most organizations are able to remediate, there is a bit of a lag there.

This example I gave you. For one organization to have a billion findings with a B, it's not a joke. And just because their findings doubled, more than doubled in a day, doesn't mean the size of your team went up by even 20% or 30%, right?

So now how do you think about looking at these vulnerabilities? How do you think about addressing this? And I think a big part of that will be just because there is a finding doesn't mean it is applicable in your environment.

Mm-hmm. Right? If detections are coming out at machine speed, it will become important to recognize that everything is not applicable to my environment.

And then you have to think about what is important and how do I address that? So obviously, the first thing is you get full visibility into what you have. You need to know that.

Mm-hmm. But then the second part is you say using concepts like asset criticality, the business context of that asset, applying threat intel, and threat signals for that misconfiguration of finding, and then saying, for a particular finding, what is the impact in my environment? Is it mitigated by other tools that I have in my environment?

Whether that's an endpoint tool, whether that's a firewall, whether that's a WAF. We have to account for all of that and then say, what is the smaller subset that I need to focus on? Now, what this also means is you have to think of security and security tooling more holistically.

Because every organization has a lot of tools, and every tool is giving you a lot of dashboards. " Right? And then you reduce the scope of what's important, what's critical, and focus on that and get that done.

So at the show, you guys launched a new product that addresses some of this. So where does that fit in the portfolio? Well, the biggest overarching theme of how we are looking at this is the concept of a risk operation center.

Right? " And what we want to do now is we want to equip our customers to make sense of all the data that they have collected, to actually make sense of all the dashboards that they're getting from all the different vendors that they have. " And that critical set can come by what I explained, you look at asset context, business context, criticality.

But then we are doing a lot of other things, too. We've launched True Confirm. True Confirm is not only are we telling you there's a finding, we will actually do a benign exploit check to validate that finding.

Right? And then if we are able to do that check, we will tell you with 100% accuracy that should an adversary do the same thing, they will get into your system. Right?

Mm-hmm. So we have built those kinds of capabilities. Really the idea there being, again, focus on what's most important.

But I think also a bigger change that we are seeing across the industry is because the volume is growing so much, and teams are not growing at that pace, that will never happen. There is a shift happening to more automated and autonomous remediation. The appetite for that is growing.

Mm-hmm. And to say that I have findings, I have misconfigurations, but there are a good chunk of those that I can fix in a completely automated manner, and that will reduce my risk score, but it'll not get stuck in the cycle of we need to first validate that in a lower tier environment and then push it up. Now to support that, in the platform, we are also adding a lot of other capabilities.

0 with True Confidence. And what we are doing there is even before you apply a patch, we are validating what the impact of that patch has been across our wide environment. " Or we think with almost near 100% accuracy, go ahead and push the patch, there should be no risk here.

So we are giving that capability. But then post-patch, we are saying we will monitor your asset now, and we will detect for maybe spikes in CPU memory to see if there's anomalous behavior. And if there is, we will notify you, and we will work with you to roll back that patch as part of the platform.

And this shift towards more automated remediation, this is needed and required. The industry's moving in that direction. I think giving that confidence, as I'm talking to a lot of CISO's and other security leaders, they appreciate that part.

" That's happening. So you hosted a panel here at the show. So what do you know now that you didn't know a couple of hours ago?

Oh. It's really interesting, these conferences. Obviously, we host these conferences because we want to share with our customers on what we are doing, what we are working on, the innovations that we are working on, and how we think it will benefit them.

But one of the things that I value more is the time that I get to spend with customers at the conference. And that's a big part of many of us being here, right, to spend time with customers, not necessarily over a Zoom call, but in person, understanding what their environment is, understanding what their experiences are, and there is a lot of takeaways that come out of that. And those takeaways many times guide how we think of product.

We are a very customer-focused company. We are very engineering focused. And the way we think of it, and you've probably heard Samad say this numerous times, we want to meet customers where they are at and build capabilities and solutions that are meaningful to them that will actually reduce their risk score.

And that same thing has happened. Not just over the last two hours, but I'd say over the last three, four days as I'm talking to customers. For existing products, you get feedback on, you guys have this capability, here's how we are thinking about it.

And we should partner on that. And there's already a number of follow-up discussions and onsites that are set up with customers for us to do deep dives on those topics. Whether those topics are around vulnerability management or enterprise risk management, which is our implementation of the Risk Operation Center, and obviously a big focus of how we see vulnerability management evolving into this combination of CTEM, CRQ, and REM Ops.

There's a lot that's going on in that space. And then, of course, newer things as AI security is a big thing now. Visibility into AI is a really big thing.

Most folks are struggling just to get visibility into what they have. " A lot of our products actually come out that way. Mm-hmm.

And these conferences are a good place to get some of those insights and then continue on those and build on that. All right, folks. You heard it here.

Qualys is looking for your feedback on new product development, so reach out. Absolutely. All right.

Thank you so much. And we'll be back in a minute.